Add pre-install npm dependency guard

lib/init.js

@@ -0,0 +1,30 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { DEFAULT_POLICY, HTTP_TIMEOUT_MS } from "./constants.js";
+import { readProject } from "./project.js";
+import { fetchPackageDocument } from "./verify.js";
+import { normalizeRepository } from "./util.js";
+
+export async function initPolicy(options, injected = {}) {
+  const project = await readProject(resolve(options.path));
+  const policy = structuredClone(DEFAULT_POLICY);
+  const skipped = [];
+  const dependencies = { fetchImpl: injected.fetch ?? globalThis.fetch, timeoutMs: options.httpTimeoutMs ?? HTTP_TIMEOUT_MS };
+  for (const item of project.direct) {
+    const document = await fetchPackageDocument(item.name, dependencies);
+    const versionData = document.versions?.[item.version];
+    if (!versionData) throw new Error(`${item.name}@${item.version} is absent from npm registry metadata`);
+    const repository = normalizeRepository(versionData.repository ?? document.repository);
+    if (!repository) {
+      skipped.push(`${item.name}@${item.version}: no GitHub repository; not trusted`);
+      continue;
+    }
+    policy.trustedRepositories[item.name] = repository;
+    const maintainers = (versionData.maintainers ?? document.maintainers ?? []).map((entry) => entry.name).filter(Boolean).sort();
+    if (maintainers.length) policy.trustedMaintainers[item.name] = [...new Set(maintainers)];
+  }
+  const output = resolve(options.output);
+  await mkdir(dirname(output), { recursive: true });
+  await writeFile(output, `${JSON.stringify(policy, null, 2)}\n`, { flag: "wx", mode: 0o600 });
+  return { policy, skipped, output };
+}